Slashdot Log In
Researchers Face Jail Risk For Tor Snooping Study
Posted by
CmdrTaco
on Thu Jul 24, 2008 09:50 AM
from the learning-is-dangerous-business dept.
from the learning-is-dangerous-business dept.
An anonymous reader writes "A group of researchers from the University of Colorado and University of Washington could face both civil and criminal penalties for a research project (PDF) in which they snooped on users of the Tor anonymous proxy network. Should federal prosecutors take interest in the project, the researchers could also face up to 5 years in jail for violating the Wiretap Act. The researchers neither sought legal review of the project nor ran it past their Institutional Review Board. The Electronic Frontier Foundation, which has written a legal guide for Tor admins, strongly advises against any sort of network monitoring."
Related Stories
Submission: Researchers face jail risk for Tor snooping study by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
You can't jail them@ (Score:3, Funny)
Re:You can't jail them@ (Score:5, Funny)
I guess if they get jail time, the lesson to learn is "Do as I say, not as I do."
Parent
Re: You can't jail them (Score:5, Insightful)
Something that the CNET article failed to address was this: This work was _exactly_ in line with the norms and standards of networking research. It is quite normal for network operators to collect partial or full traffic traces, for both operational and research purposes.
If you believe that this study was inappropriate, then so is a very large fraction of networking measurement research. Consider at the very least:
* Just about everything done by CAIDA [caida.org].
* The papers at IMC [imconf.net] - the Internet Measurement Conference.
* Data at CRAWDAD [dartmouth.edu] - the Community Resource for Archiving Wireless Data at Dartmouth.
A large part of computer science research consists of observing how systems are used and how they work or don't work. You can do some small-scale studies on a private system with the explicit agreement of all users, but for something as large and complicated as the Internet, the only way to do meaningful research is to observe the real thing, which necessarily means that you can't identify and get the consent of all the users involved. That's the way this field works. Responsible researchers collect the least invasive information possible for their purposes, use it benignly, and anonymise anything they release so that individual users cannot be identified. The authors of this study did exactly those things.
Now, if you want to ban all observation-based networking research, I suppose that's a legitimate position. But you have to be willing to forgo the benefits of that research. Otherwise, you should accept that the authors acted responsibly and within the norms of the field. Moreover, the purpose of this research was to understand and thereby _improve_ TOR. The researchers identified several serious problems which were already being exploited by "black hats" for malicious purposes. Research like this enables those problems to be addressed before actual harm results.
Parent
Re:You can't jail them@ (Score:5, Funny)
Parent
Re:You can't jail them@ (Score:5, Insightful)
Speaking of the Bush administration and violating wiretapping laws...
Parent
Re: (Score:2, Insightful)
If you do a legitimate study on the effects of different strains of marijuana, and control the genetics by growing the pot yourself, without all the impossible to get paperwork and permissions, you're going to prison.
Why should these guys be any different? In the case of the reefer nobody's hared, in these guys' cases they invaded innocent people's privacy. Not only were their actions illegal, they were highly unethical.
Re:You can't jail them@ (Score:5, Interesting)
How is their study either unethical, or illegal as you have claimed? Ignoring your hypothetical marijuana study as completely irrelevant you seem to have missed the key points in what they did.
They did not run a "wiretap" as claimed. They monitored the traffic at a tor node that they controlled. People willingly sent them the information that was supposed to be private.
Their study is a scientific investigation into whether the privacy claims of Tor can be sustained. They cannot - the system is open to abuse. This is an entirely ethical study into the claims made by Tor, and furthermore this is exactly how good empirical science should work.
Parent
Re: (Score:3, Interesting)
I may be missing something, but isn't the whole point of tor that something like this isn't possible?
If this actually points out flaws in tor that may have been missed, and the info is made publicly available, won't this help strengthen the system?
Re:You can't jail them@ (Score:5, Funny)
Parent
Correct link to study (Score:5, Informative)
Re:Correct link to study (Score:4, Informative)
I don't wonder that the Tor people are upset by this study, because it makes some credible-looking claims that Tor does not adequately provide the anonymity it claims to. Amongst other things, the researchers warn that the design of the network can allow different actions by the same user to to be associated.
They also warn about things that have led many to doubt the project from the start: that (in their language) 'misbehaving' nodes can be set up that could take a range of actions detrimental to users.
Lest this be thought to be a hypothetical threat, consider this from their conclusion:
>we developed a method for detecting malicious
>logging exit routers, and provided evidence that
>there are such routers that
>speciïcally log insecure protocol exit traïfc
They also note that while they ran their node, they received numerous accusations of illegal activity, traced to their node's IP address. This has always been a danger for node operators - this test confirms it is a real threat.
Frankly, a reader of this report would be wise to reconsider Tor usage.
Parent
Re: (Score:3, Insightful)
I don't wonder that the Tor people are upset by this study, because it makes some credible-looking claims that Tor does not adequately provide the anonymity it claims to.
I don't know where you get that idea. TOR developers are perfectly aware of TOR's limitations. They even warn you on their website [torproject.org].
They say specifically,
3. No anonymity system is perfect these days, and Tor is no exception: you should not rely solely on the current Tor network if you really need strong anonymity.
And in the list of warnings,
5. While Tor blocks attackers on your local network from discovering or influencing your destination, it opens new risks: malicious or misconfigured Tor exit nodes can send you the wrong page, or even send you embedded Java applets disguised as domains you trust.
Nothing in this study is new or ground-breaking. While I am not familiar enough with TOR to say whether if it will even be marginally useful, but I won't be surprised if there is nothing in this study that TOR developers didn't know or suspect already.
Yeah, who do those "researchers" think they are... (Score:5, Funny)
not to worry (Score:5, Insightful)
...the researchers could also face up to 5 years in jail for violating the Wiretap Act.
I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.
Nope (Score:5, Insightful)
Not unless they have millions to spend on lobbyists.
Parent
Re:not to worry (Score:4, Insightful)
I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.
One could only hope. Fads tend to run their course and then quickly fade away. I have a bad feeling this is more of a long term trend.
Parent
Re:not to worry (Score:5, Insightful)
...the researchers could also face up to 5 years in jail for violating the Wiretap Act.
I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.
For that to work there's a preset number of times that you must use "terrorist", "nine" and "eleven" in your reasoning.
Parent
Re:not to worry (Score:4, Funny)
No, you just have to hand over $9.11 to Congress.
They're cheap now.
Parent
Re:not to worry (Score:5, Insightful)
Parent
Re: (Score:3, Interesting)
Except for one blogger, no scientists have been threatened with prosecution. The article just says that they could be prosecuted, maybe, and that they should have run this by some lawyers and/or some oversight commitee.
I hope they are not reprimanded and not fined because they clearly had no intention of wiretapping anyone and made no attempt to identify individuals or correlate their actions. 150 bytes of exit data barely gets them past the TCP/UDP and IP layers.
Re: (Score:2)
They can't be stupid. (Score:5, Interesting)
On the other hand, the story is hypothetical. No charges have been filed, and there's no real evidence that the government could give a flying flip.
Re:They can't be stupid. (Score:5, Informative)
When engaging in activities that might be legal, but might be a felony...I'll go for safe over sorry any day.
Parent
Re: (Score:3, Insightful)
They probably realized there will be no such prosecution, because prosecution would draw attention to how easily Tor activity can be monitored and conclusions drawn from it. That kind of attention is a Bad Thing: any government would instead prefer that citizens believe that they have access to something which is secret and anonymous (but which is actually not).
It's good to disrupt enemy communications. It's better to intercept enemy communications. It's best to eavesdrop on enemy communications when th
Re:They can't be stupid. (Score:5, Insightful)
If the info is passing through their own network interface - by actual design of the Tor system, and not because they have done something devious - how is this analogous to wiretapping?
Illegal wiretapping surely involves breaking into private communications that you are not intended to be part of, through either physical means, or perhaps via software - but by its nature, Tor allows anyone to connect into the network, and people know that what they are sending/receiving is going to travel through other poeple's computers (but can be fairly confident that nobody can trace anything back to them easily).
I don't see how researching into the protocol and viewing the packets that pass through your own node are illegal, unless you accept some kind of contract not to snoop when you install Tor.
Parent
Re:They can't be stupid. (Score:4, Insightful)
Having said that, anyone using TOR who actually trusts the exit nodes needs their head examined. There are exit nodes which are known to be hostile, and some operators have even publicly stated they have monitored traffic and captured login/password pairs. One should never, NEVER access anything via TOR that may correlate to their meatspace life. Either use the web read-only, or set up nym accounts on sites that require registration.
Parent
Re: (Score:3, Insightful)
The thing is that you pay your phone company and have a contract with them, and at least in those states you will know that you have the chance of being monitored as it will be part of the contract. You also know that they won't just give out those recordings to just anyone (though the government or police will probably want it at some point).
With TOR you have no contract or promise that no undesirables are listening in. There is no way of stopping someone snooping on exit nodes, so if these guys are punish
Re: (Score:2, Interesting)
> Regardless of FAQ containing legal advice to the contrary.
Well heck! It was in an FAQ? Goodness! They ignored an FAQ. This must be the first time ever in the history of the net.
But seriously. The Tor people put a little note on their software saying: "Please don't monitor the network traffic of our uber-secret software", presumably because of a fear that publicity about the nature of the websites visited by Tor users would undermine support of the project.
Quite frankly, that is a little like S/MIM
Re: (Score:3, Interesting)
Well its not really illegal! All the data is being sent over the researchers computers unencrypted!
Just because a medium is not encrypted doesn't mean it's legal to listen in on it. Your phone line is unencrypted.
Tor even states that the communication isn't secure after it hits the last "exit node" and warns users that they should not use it for security but anonymity!
"Isn't secure" in this context refers to the fact that it is not encrypted in any way. Refer to the previous argument.
It is perfectly legal to capture data which is sent to or from your personal computer/network!!!
When did TOR become your personal network?
Should have tried to get jobs at telco, first. (Score:5, Insightful)
Apparently, US Telcos can snoop all they want and it's perfectly legal, now!
Re: (Score:2)
We have the best legislators money can buy!
OT factoid... (Score:5, Interesting)
Interestingly, I was once banned from /. for running a tor node. When I found out and emailed the admins they asked if I was running a tor server - I replied in the affirmative but had since taken the node down because my SOHO router wasn't up to the task.
The /. admins were very nice and restored my access almost immediately but I found the whole process interesting.
Re: (Score:3, Interesting)
Y'know, it's entirely possible you were banned for volume of traffic related to the tor node, and that they would have restored your access anyway, once it became apparant that that volume was due to tor and not due to you having dozens of sock puppets.
Re:OT factoid... (Score:5, Informative)
Nope. Slashdot banned tor openly, as do most online discussion systems that don't want to be flooded by endless bots.
You either ban all tor users or you allow all tor users, since any one user can just reconnect through every tor node to evade ip bans(allowing them to create new accounts if their old one was banned). Most places would rather be able to ban users, so they disallow tor exit nodes.
Parent
if it is your equipment... (Score:4, Insightful)
Re:if it is your equipment... (Score:4, Interesting)
The problem is monitoring the communication itself. You can't just pick up the phone and tape record someone without their permission, or pick up a camera and videotape them. By saving the first 150b of each transmission, they were technically doing this.
TFA does a pretty good job of explaining all the varies angles - from participation without permission to individuals under 18 to international issues - but they're coming up against a number of laws, such as the Wiretap Act, which is specifically aimed at this sort of thing.
What I'm wondering though is, and I'm no tor expert, since it was so easy for these folk to set up their exit and entry nodes to log the data, what's stopping the others running tor nodes to do the same? If they can do it, surely the Chinese government could be doing the same, using it to catch all those pro-democracy bloggers. The US could (and would) definitely use this, so what's stopping them, assuming they aren't already doing it?
Parent
Re: (Score:2)
You can't just pick up the phone and tape record someone without their permission
Actually, you can do just that in a majority of the US. Only California, Connecticut, Delaware, Florida, Massachusetts, Maryland, Michigan, Montana, New Hampshire, Pennsylvania, and Washington require 2 party notification when recording a phone call.
Though in this case, all they have are "many people who use tor are from these places" and "people using tor often do these things", but no way to link who is doing what, as per the design of the network, as they would have to control all 7(?) nodes
Update to the old saying... (Score:5, Funny)
Don't wiretap. The government hates competition.
Fire them (Score:2, Insightful)
IRB? (Score:3, Interesting)
As a social science undergrad,
Which means most of your research probably involves human subjects (assuming it involves some new data collection), so of course you have to get approval. I know all about IRB from psych courses for the same reason.
Most comp sci prof rarely run human subjects (or consider that they data they're looking at comes from human subjects) and therefore often don't need to get IRB approval. The only comp sci field that I can think of that regularly would run human subjects is HCI, and even most of those studies cou
No possible jail (Score:2, Interesting)
These researchers are never going to be arrested or charged with anything.
They didnt do anything illegal.
All they did was copy data of packets passing THROUGH their Tor servers they had setup. They didnt compromise other's systems. This may be a moral question, ala reading emails that pass through your relay.
For 4 days in December 2007, they logged and stored the first 150 bytes of each network packet that crossed their network...
Re: (Score:3, Insightful)
They didnt do anything illegal. All they did was copy data of packets passing THROUGH their Tor servers they had setup. They didnt compromise other's systems. This may be a moral question, ala reading emails that pass through your relay.
At which point did it become legal to read emails that were being passed through your relay?
grammar: nor (Score:2)
"The researchers neither sought legal review of the project nor ran it past their Institutional Review Board."
They have more than the law to worry about . . . (Score:2, Informative)
Are they really not covered, though? (Score:4, Interesting)
IANAL, but following the link from the article to
18 USC 2511, reading 2(d)
"It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State."
Couldn't it be argued that since they are running the TOR server, they are a 'party to the communication', and are thus covered by this exception?
I mean, the client connects to them, they're a party to that communication, they connect to the server, they're a party to that communication ...
stupidity (Score:3, Insightful)
Anyone who assumes that Tor exit nodes aren't heavily monitored by lots of three letter agencies, private companies, and researchers is a fool.
If Tor's utility depended on legal protections, it would be a lost cause. What Tor actually does for you is obscure your IP address, nothing more and nothing less. That is very useful. But you still need to make sure that your content is clean. That's why Tor is often used with software like Privoxy.
If anybody actually goes after these security researchers, it's not to protect the privacy of Tor users, it's to prevent the researchers for alerting Tor users to protecting their identity better, because once 99.9% of the Tor traffic is encrypted, listening in becomes much less useful.
Article is misleading (Score:4, Insightful)
Re: (Score:2, Insightful)
It depends on the information. Can I have your Social Security number, your bank account number and debit card PIN number? You don't even wat your name posted; not even your slashdot user name!
Sharing SOME knowedge is good, sharing other knowledge is bad. Your anonymous cries of slashdot hypocricy ring hollow.
Re: (Score:2)
I fail to see how the government or any of the others you named are responsible for Tor being insecure.
Tor is an example of why layers of security are not cumalative. The weakest link is not strengthened by putting a plastic sleeve around the chain or putting a bigger lock on the end.
Could you please provide a link to the coming open source secure network, cause I've never heard of such a thing and would love to take a look at it.
Re:All this proves is... (Score:5, Insightful)
...that Tor is in and of itself not secure enough. Any traffic passing over it needs intermediary obfuscation of origination and destination of traffic as well as encryption of traffic by the origination and destination separate from the Tor network similar to anonymous remailer chains.
Tor does encrypt data passing through the network, and it does obfuscate the source and destination... That's kind of the whole point. But unless the traffic is inherently encrypted (e.g. SSL), the exit node has to spit out unencrypted data, otherwise the final destination would have no idea as to what it was receiving.
Parent